1055 matches found
CVE-2013-4791: Improper Neutralization of Input During Web Page Generation
PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE...
CVE-2011-4906
Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution...
Unrestricted file upload
Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution...
CVE-2011-4906
CVE-2011-4906 concerns a vulnerability in the TinyMCE 3.0 editor integrated into Joomla! prior to 1.5.13. The connected documents confirm that an improper file upload mechanism could allow arbitrary PHP code execution via the TinyMCE-based upload path, enabling an attacker to execute code remotel...
CVE-2011-4906
Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution...
CVE-2011-4906: Unrestricted Upload of File with Dangerous Type
Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution...
PT-2020-7142
Name of the Vulnerable Software and Affected Versions Joomla! versions prior to 1.5.13 Description The issue allows file upload and arbitrary PHP code execution through the Tiny browser in the TinyMCE 3.0 editor. Recommendations For versions prior to 1.5.13, update to version 1.5.13 or later to...
Cross-site Scripting (XSS)
tinymce is vulnerable to cross-site scripting XSS. The attack exists because it does not prevent the attacker from injecting a malicious script into the editor via the clipboard or APIs, allowing to execute the script when a user loads the editor...
GHSA-27GM-GHR9-4V95 Cross-site scripting vulnerability in TinyMCE
Impact A cross-site scripting XSS vulnerability was discovered in: the core parser, paste and visualchars plugins. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are...
@enhavo/form (>=0.1.2, <=0.8.5), @enhavo/translation (>=0.8.4, <=0.8.5) +14 more potentially affected by CVE-2020-17480 via tinymce (>=5.0.6, <=5.1.0)
tinymce NPM version =5.0.6, =0.1.2, =0.8.4, =0.18.0, =15.0.1, =1.0.0, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =2.4.3, =1.0.0, =2.14.3, =1.2.3, =2.2.81 and more Source cves: CVE-2020-17480 Source advisory: OSV:GHSA-27GM-GHR9-4V95...
@angular-materials/ngx-admin (>=1.0.0, <=1.0.1), @ec.components/tinymce (>=0.5.7, <=0.6.0) +37 more potentially affected by CVE-2020-17480 via tinymce (>=4.5.1, <=4.9.5)
tinymce NPM version =4.5.1, =1.0.0, =0.5.7, =0.1.1, =0.0.13, =1.3.0, =8.0.0, =0.8.8, =0.6.3, =1.2.0, =1.0.0-alpha.0, =1.1.0, =2.2.0 - common-library 0.0.0 - connectwise-manager 10.0.0 and more Source cves: CVE-2020-17480 Source advisory: OSV:GHSA-27GM-GHR9-4V95...
Cross-Site Scripting (XSS)
tinymce is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a user's browser via the HTML comments and CDATA information...
8x8: (Critical) Remote Code Execution Through Old TinyMCE upload bypass
A third party marketing site utilized an outdated version of TinyMCE that was vulnerable to CVE-2011-4906...
CVE-2014-4548
CVE-2014-4548 : The Ruven Toolkit WordPress plugin (
CVE-2014-4548: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in tinymce/popup.php in the Ruven Toolkit plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the popup parameter...
CVE-2013-1426
Cross-site Scripting XSS in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor...
CVE-2013-1426
Cross-site Scripting XSS in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor...
Cross site scripting
Cross-site Scripting XSS in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor...
CVE-2013-1426
Affected software: Mahara. Vulnerable component: TinyMCE editor used in Mahara pages. Root cause: Cross-site Scripting (XSS) in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary script/HTML via the TinyMCE editor. Impact: potential remote code execution in the...